M365 Copilot connector: sign-in completes but connection fails (“Connection Didn’t Complete”), suspected COOP header issue

Summary
Connecting the a custom federated connector in Microsoft 365 Copilot fails after a successful sign-in. Copilot shows “Connection Didn’t Complete – Your sign-in may have succeeded, but we couldn’t finish the connection.” The suspected cause is the Cross-Origin-Opener-Policy: same-origin-allow-popups header on the login page in the OAuth popup’s redirect chain. That header severs the popup’s window.opener reference.

Environment

• Connector: custom federated connector (M365 admin center), OAuth 2.0

Already ruled out

• Token audience and issuer: a manual auth code flow with the same client, without a resource parameter, returned a valid token with the correct audience and issuer
• Reference ID: resolves correctly in the admin center.

Hypothesis
Copilot completes OAuth in a popup. Microsoft’s redirect page passes the result back to the Copilot tab through window.opener. Our auth routes serve Cross-Origin-Opener-Policy: same-origin-allow-popups. When the popup, opened from a Microsoft origin, navigates to one of these pages, the COOP mismatch triggers a browsing-context-group switch and window.opener becomes null. This used to be the same in the Copilot Studio MCP setup, but that is now no longer required, so for the same server, the setup succeeds in Copilot Studio. Can you confirm that this COOP header is the issue in this flow?

The opener is lost directly. When reaching the sign-in page for the connector, window.opener is null. If so, why is this requirement in place for this specific flow to succeed while it's not necessary for the Copilot Studio MCP flow when creating a new agent?